Diagnose: Terraform azurerm backend: state lock held or backend auth failed

SYMPTOM
Terraform azurerm backend: state lock held or backend auth failed

CAUSE
Two flavors: 'Error acquiring the state lock' (a previous apply crashed or is still running) and backend auth failures (the backend block authenticates separately from the provider).

CONFIRM IT
CONFIRM: lock error names the lock ID and who holds it - check whether that apply is actually still running before force-unlocking. Backend auth failure happens at `terraform init`, provider auth failure at `plan`: the stage tells you which block is misconfigured.

FIX
FIX: lock genuinely orphaned: `terraform force-unlock [id]` (only when sure nothing is running). Backend auth: give the backend the same ARM_ env vars / OIDC as the provider, or a valid SAS for the state blob. Never delete the state blob to clear a lock.

VERIFY
VERIFY: `terraform init` then `plan` runs clean with no lock error; state blob lease is free.